CVE-2019-14832

Se encontró un fallo en la API REST de Keycloak anterior a la versión 8.0.0, donde se permitiría el acceso del usuario desde un dominio en el que el usuario no fue configurado. Un atacante autenticado con conocimiento de un id de usuario podría usar este fallo para acceder a información no autorizada o llevar a cabo futuros ataques.

A flaw was found in the Keycloak REST API where it would permit user access from a realm the user was not configured. An authenticated attacker with knowledge of a user id could use this flaw to access unauthorized information or to carry out further attacks.

Red Hat Single Sign-On 7.3 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. This release of Red Hat Single Sign-On 7.3.4 on RHEL 8 serves as a replacement for Red Hat Single Sign-On 7.3.3, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Issues addressed include bypass and code execution vulnerabilities.